Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify internet-reachable DTLS service
  2. Delivery
    Send crafted DTLS records with duplicate sequence numbers
  3. Exploit
    Trigger comparator undefined behavior in reordering buffer
  4. Execution
    Process crash or hang
  5. Impact
    Service unavailable to legitimate clients

Vulnerability Assessment

Weakness
CWE
CWE-475
ASVS 5.0
V15 - Secure Coding and Architecture Undefined behavior for input
Exploitation Conditions

Exploitation requires a network-reachable DTLS listener backed by GnuTLS - the bug is specifically in the DTLS packet reordering path, so TLS-over-TCP deployments are not affected even if they link the same GnuTLS library. The attacker must be able to send UDP datagrams to the DTLS port and craft records carrying duplicate DTLS sequence numbers to drive the buggy comparator. No authentication, user interaction, or non-default configuration is needed (CVSS PR:N/UI:N/AC:L), but services that do not expose DTLS (DTLS disabled, firewalled off, or using a non-GnuTLS DTLS stack) are out of scope.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity loss - consistent with a DoS-only flaw. EPSS data was not supplied, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis. Real-world risk is highest for servers terminating DTLS on internet-facing interfaces (e.g., VPN concentrators, SIP/WebRTC gateways, IoT MQTT-over-DTLS endpoints) using GnuTLS; pure TLS-over-TCP deployments are not in scope since the bug is in DTLS reordering. The lack of confidentiality/integrity impact and the absence of KEV/POC signals suggest this is a moderate-priority patch - important for high-availability DTLS services but not an emergency for TLS-only workloads.
Exploit ScenarioDerived

An attacker reachable over the network sends a stream of DTLS records to a GnuTLS-backed server (for example, a DTLS-based VPN or WebRTC gateway), deliberately including records with duplicate sequence numbers to trigger the broken comparator in the reordering buffer. The resulting undefined behavior crashes or hangs the GnuTLS-using process, denying service to legitimate clients; no authentication or user interaction is required, but no public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 18, 2026

Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references - monitor https://access.redhat.com/security/cve/CVE-2026-42009 and https://bugzilla.redhat.com/show_bug.cgi?id=2467279 for the fixed GnuTLS package versions and apply distribution updates (dnf/yum/apt) once published. As compensating controls until a patched build is available, restrict DTLS endpoints to trusted network segments via firewall rules on the UDP port in use (typically 443, 4433, or application-specific), rate-limit inbound DTLS handshakes and records at the network edge to blunt high-volume DoS attempts, and where feasible disable DTLS in favor of TLS-over-TCP for the affected service (trade-off: loses DTLS latency benefits and breaks UDP-based VPN/voice workloads). Switching the application's TLS backend to OpenSSL or another library is a heavier mitigation that may not be viable for distribution-packaged software.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GnuTLS is a widely deployed open-source implementation of the TLS and DTLS protocols, used as a TLS library by GNOME applications, CUPS, Wireshark, FFmpeg, and many Linux distributions as an alternative to OpenSSL. The flaw resides in DTLS-specific code that reorders out-of-order datagrams before passing them to the application layer - DTLS, unlike TLS, runs over UDP and must tolerate reordering and loss. CWE-475 (Undefined Behavior for Input to API) applies because the comparator function passed to the sorting routine violates strict weak ordering when two records share the same sequence number, which is undefined behavior in C library sort implementations (qsort/mergesort) and can yield inconsistent state, infinite loops, or memory corruption depending on the implementation.

Know when Gnutls gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Executive ViewAI

Why It Matters

GnuTLS, a critical cryptographic library used across enterprise security infrastructures, contains a denial-of-service vulnerability that allows remote attackers to disrupt DTLS-based secure communications without authentication. Organizations relying on GnuTLS for secure datagram transport face immediate availability risk with potential cascading impact on encrypted communication channels. The absence of a vendor patch requires immediate tactical mitigations to prevent service disruption.

Business Impact: High
Compensating Controls

Implement network-level rate limiting and connection throttling on DTLS ports (default UDP 443); restrict DTLS service access via firewall to trusted networks only; deploy network segmentation to isolate systems running GnuTLS from untrusted clients; monitor GnuTLS mailing lists and advisory channels for patch notification. Permanent remediation requires vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 69% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:8.10:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:8.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:8.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_els:9.8:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:arm64:*
cpe:2.3:o:redhat:enterprise_linux_for_eus:9.8:*:*:*:*:*:x64:*
+ 24 more

More in Gnutls

View all
CVE-2021-20231 CRITICAL POC
9.8 Mar 12

A flaw was found in gnutls. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentic
CVE-2014-3466 MEDIUM POC
6.8 Jun 03

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15
CVE-2020-24659 HIGH POC
7.5 Sep 04

An issue was discovered in GnuTLS before 3.6.15. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
CVE-2024-0553 HIGH POC
7.5 Jan 16

A vulnerability was found in GnuTLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth
CVE-2024-0567 HIGH POC
7.5

Alpine Linux: gnutls fixed in 3.8.3-r0
CVE-2012-1663 HIGH POC
7.5 Mar 13

Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (app
CVE-2023-0361 HIGH POC
7.4 Feb 15

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. Rated high severity (C
CVE-2019-3836 HIGH POC
7.5 Apr 01

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versio
CVE-2019-3829 HIGH POC
7.5 Mar 27

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. Rated high severity (CVSS 7.5), this vulnerability
CVE-2012-1569 MEDIUM POC
5.0 Mar 26

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other pr
CVE-2017-5334 CRITICAL
9.8 Mar 24

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 al
CVE-2012-1573 MEDIUM POC
5.0 Mar 26

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with

Same weakness CWE-475 – Undefined Behavior for Input to API

View all
CVE-2024-10569 HIGH POC
7.5
CVE-2024-3099 MEDIUM POC
5.4
CVE-2026-19311 HIGH
8.6
CVE-2025-47865 HIGH
7.5
CVE-2024-20380 HIGH
7.5
CVE-2020-7925 HIGH
7.5
CVE-2023-4874 MEDIUM
6.5
CVE-2023-2253 MEDIUM
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:13274 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42009 ADVISORY https://ubuntu.com/security/notices/USN-8284-1 ADVISORY https://vuldb.com/vuln/364468 REF https://access.redhat.com/errata/RHSA-2026:20611 REF https://access.redhat.com/errata/RHSA-2026:20612 REF https://access.redhat.com/errata/RHSA-2026:20613 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:26409 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:29794 REF https://access.redhat.com/errata/RHSA-2026:30004 REF https://access.redhat.com/errata/RHSA-2026:30849 REF https://access.redhat.com/errata/RHSA-2026:30850 REF https://access.redhat.com/errata/RHSA-2026:32962 REF https://access.redhat.com/errata/RHSA-2026:33125 REF https://access.redhat.com/errata/RHSA-2026:34372 REF https://access.redhat.com/errata/RHSA-2026:34764 REF https://access.redhat.com/errata/RHSA-2026:34788 REF https://access.redhat.com/errata/RHSA-2026:36004 REF https://access.redhat.com/errata/RHSA-2026:36005 REF https://access.redhat.com/errata/RHSA-2026:36006 REF https://access.redhat.com/errata/RHSA-2026:40762 REF https://access.redhat.com/errata/RHSA-2026:41921 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-42009 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467279 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json REF https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy